package tc.alert.tckejisoc.domain;

import lombok.Data;
import org.springframework.data.annotation.Id;
import org.springframework.data.annotation.Transient;
import org.springframework.data.elasticsearch.annotations.DateFormat;
import org.springframework.data.elasticsearch.annotations.Field;
import org.springframework.data.elasticsearch.annotations.FieldType;

import java.util.Map;

/**
 * 扁平化安全事件实体类 - SOC 安全运营中心
 * Elasticsearch 索引: soc_security_events
 */
@Data
public class EventBase {

    // ========== 基础元数据 ==========
    @Id
    @Field(name = "event_id", type = FieldType.Keyword)
    private String eventId;     // 事件唯一ID (格式: 设备类型-哈希值)

    @Field(name = "@timestamp")
    private String timestamp;    // 事件入库时间戳 (UTC毫秒)

    @Field(name = "event_type", type = FieldType.Keyword)
    private String eventType;   // 事件类型 (标准值: login/file_access/firewall_alert等)
    @Field(name = "event_name", type = FieldType.Keyword)
    private String eventName;   // 事件名称

    @Field(name = "event_rule", type = FieldType.Keyword)
    private String eventRule;   // 事件规则id
    @Field(name = "event_time", type = FieldType.Date, format = DateFormat.epoch_millis)
    private String eventTime;   // 事件时间

    @Field(name = "severity", type = FieldType.Integer)
    private Integer severity;   // 危险等级 (1-5)

    @Field(name = "name", type = FieldType.Integer)
    private Integer name;   // 日志来源名称 （火绒，waf，edr）

    // ========== 资产信息 ==========
    @Field(name = "device_name", type = FieldType.Keyword)
    private Integer deviceName;  //安全设备名称
    @Field(name = "device_ip", type = FieldType.Keyword)
    private Integer deviceIp;  //安全设备ip
    @Field(name = "attack_packets", type = FieldType.Keyword)
    private Integer attackPackets;  //攻击报文


    @Field(name = "dstassetname", type = FieldType.Keyword)
    private Integer dstassetname;  //目的资产名称

    @Field(name = "srcassetname", type = FieldType.Keyword)
    private Integer srcassetname;  //源资产名称

    @Field(name = " security_domains", type = FieldType.Keyword)
    private Integer securityDomains;   //安全域

    // ========== 源端点信息 ==========
    @Field(name = "src_ip", type = FieldType.Keyword)
    private String srcIp;       // 源IP地址

    @Field(name = "src_type", type = FieldType.Keyword)
    private String srcType;       // 是否内部资产  0 非 1 是

    @Field(name = "src_port", type = FieldType.Integer)
    private Integer srcPort;    // 源端口

    @Field(name = "src_hostname", type = FieldType.Keyword)
    private String srcHostname; // 源主机名

    @Field(name = "src_mac", type = FieldType.Keyword)
    private String srcMac;      // 源MAC地址

    // ========== 目标端点信息 ==========
    @Field(name = "dst_ip", type = FieldType.Keyword)
    private String dstIp;       // 目标IP

    @Field(name = "dst_type", type = FieldType.Keyword)
    private String dstType;

    // 是否内部资产  0 非 1 是
    @Field(name = "dst_port", type = FieldType.Integer)
    private Integer dstPort;    // 目标端口

    @Field(name = "dst_hostname", type = FieldType.Keyword)
    private String dstHostname; // 目标主机名

    // ========== 用户上下文 ==========
    @Field(name = "user_name", type = FieldType.Keyword)
    private String userName;     // 用户名


    // ========== 网络协议信息 ==========
    @Field(name = "req_method", type = FieldType.Keyword)
    private String reqMethod;   // HTTP方法

    @Field(name = "req_url", type = FieldType.Keyword)
    private String reqUrl;     // 请求URL
    @Field(name = "req_referer", type = FieldType.Keyword)
    private String reqReferer;     // Referer
    @Field(name = "req_referer", type = FieldType.Keyword)
    private String reqBody;     // R请求体
    @Field(name = "req_status", type = FieldType.Integer)
    private Integer reqStatus;  // HTTP状态码

    @Field(name = "req_user_agent", type = FieldType.Text)
    private String reqUserAgent;   // 用户代理原始字符串

    @Field(name = "req_host", type = FieldType.Text)
    private String reqHost;   // 用户代理原始字符串

    @Field(name = "log_type", type = FieldType.Text)
    private String logType;   // 日志类型

    @Field(name = "req_host", type = FieldType.Text)
    private String reqHeader;   //请求头
    @Field(name = "reqxff", type = FieldType.Text)
    private String reqxff;   // xff

    @Field(name = "req_cookie", type = FieldType.Text)
    private String reqCookie;   // cookie

    @Field(name = "req_xwafuuid", type = FieldType.Text)
    private String reqWwafuuid;   // X-WAF-UUID

    @Field(name = "rsp_location", type = FieldType.Text)
    private String rspLocation;   // 响应location

    @Field(name = "rsp_code", type = FieldType.Text)
    private String rspCode;   // 响应码

    @Field(name = "rsp_body", type = FieldType.Text)
    private String rspBody;   // 响应体







    @Transient
    private String rspBody1;   // 响应体

    // ========== 威胁情报 ==========
    @Field(name = "threat_category", type = FieldType.Keyword)
    private String threatCategory; // 威胁分类

    @Field(name = "threat_signature", type = FieldType.Keyword)
    private String threatSignature; // 威胁特征ID

    @Field(name = "threat_indicators", type = FieldType.Object)
    private Map<String, Object> threatIndicators; // 威胁指标

    // ========== 地理位置 ==========
    @Field(name = "geo_country", type = FieldType.Keyword)
    private String geoCountry;  // 国家

    @Field(name = "srcgeolat", type = FieldType.Keyword)
    private String srcgeolat; // 经纬度

    @Field(name = "srcgeolon", type = FieldType.Keyword)
    private String srcgeolon; // 经纬度 (格式: "lat,lon")

    @Field(name = "srcgeocity", type = FieldType.Keyword)
    private String srcgeocity;     // 城市名称

    @Field(name = "dstgeocountry", type = FieldType.Keyword)
    private String dstgeocountry;  // 国家

    @Field(name = "dstgeolat", type = FieldType.Keyword)
    private String dstgeolat; // 经纬度

    @Field(name = "dstgeolon", type = FieldType.Keyword)
    private String dstgeolon; // 经纬度 (格式: "lat,lon")

    @Field(name = "dstgeocity", type = FieldType.Keyword)
    private String dstgeocity;     // 城市名称
    // ========== 事件==========
    @Field(name = "protocol", type = FieldType.Keyword)
    private String protocol; //协议
    // ========== 原始数据 ==========
    @Field(name = "raw_log", type = FieldType.Text, index = false)
    private String rawLog;      // 原始日志（不索引）
    // ========== 运营字段 ==========
    @Field(name = "blocked", type = FieldType.Keyword)
    private String blocked; // 安全设备处置结果

    @Field(name = "action", type = FieldType.Keyword)
    private String action; // 联动soar 处置结果

    @Field(name = "deviceos", type = FieldType.Keyword)
    private String deviceos; //

    @Field(name = "lianjie", type = FieldType.Keyword)
    private String lianjie; // 连接方式


    //waf 新增

    @Field(name = "rsp_start_time", type = FieldType.Keyword)
    private String rspStartTime; // 响应开始时间

    @Field(name = "rsp_end_time", type = FieldType.Keyword)
    private String rspEndTime; // 响应结束时间


    @Field(name = "query_string", type = FieldType.Keyword)
    private String query_string; // 查询参数


    @Field(name = "payload", type = FieldType.Keyword)
    private String payload; // 攻击payload


    @Field(name = "res_header", type = FieldType.Keyword)
    private String rsp_header; // 返回头
    @Field(name = "req_start_time", type = FieldType.Keyword)
    private String reqEndTime; // 请求结束时间

    @Field(name = "req_start_time", type = FieldType.Keyword)
    private String reqStartTime; // 请求开始时间
    /**

     * query_string	Text	是	请求参数
     * response_code	Text	是	返回码
     * response_header	Text	是	返回头
     * response_body	Text	是	返回体
     * srcGeoAddress	Text	是	告警来源（例如鹏博士宽带、阿里云、腾讯云IP.......）
     */
    //edr 火绒

    @Field(name = "white_rule_effect", type = FieldType.Keyword)
    private String white_rule_effect; // 是否加白

    @Field(name = "recname", type = FieldType.Keyword)
    private String recname; // 病毒名称\备注\安装软件\软件分类

    @Field(name = "taskname", type = FieldType.Keyword)
    private String taskname; // 查杀类型

    @Field(name = "md5", type = FieldType.Keyword)
    private String md5; // v病毒md5

    @Field(name = "procname", type = FieldType.Keyword)
    private String procname; // 操作进程

    @Field(name = "cmdline", type = FieldType.Keyword)
    private String cmdline; // 操作进程命令行

    @Field(name = "p_cmdline", type = FieldType.Keyword)
    private String pCmdline; // 父进程命令行

    @Field(name = "path_name", type = FieldType.Keyword)
    private String path_name; // event.objec  病毒路径

    @Field(name = "os_type", type = FieldType.Keyword)
    private String osType; // 系统类型

    @Field(name = "res_data", type = FieldType.Keyword)
    private String resData; // 保护内容拓展

    @Field(name = "res_path", type = FieldType.Keyword)
    private String resPath; // 保护路径

    @Field(name = "recnameVal", type = FieldType.Keyword)
    private String recnameVal; // 安装软件名称

    @Field(name = "mail_from", type = FieldType.Keyword)
    private String mailFrom; // 发件人

    @Field(name = "mail_to", type = FieldType.Keyword)
    private String mailTo; // 收件人

    @Field(name = "detail ", type = FieldType.Keyword)
    private String detail ; // 防护详情


    @Field(name = "func ", type = FieldType.Keyword)
    private String func ; // 防护项目

    @Field(name = "kbid ", type = FieldType.Keyword)
    private String kbid ; // 补丁编号

    @Field(name = "level ", type = FieldType.Keyword)
    private String level ; // 补丁类型


}